Policy Compliance with Sigstore - From Signing Software to Validating the Whole Software Supply Chain
Explore sigstore for software signing and verification, and learn how to implement policy compliance in cloud-native software build and deployment processes using automation and tools.
Software Supply Chain Integrity with Sigstore
Learn about Sigstore, a tool for securing software supply chains, with demos on Cosign for signing and verifying artifacts, and insights on its practical applications.
Privacy-preserving Approaches to Transparency Logs
Explore append-only transparency logs, their applications in infrastructure, and privacy-preserving techniques to balance immutability with user rights and data protection.
Gitsign - Keyless Git Commit Signing
Explore Gitsign, a Sigstore project enabling keyless Git commit signing. Learn its functionality, integration with Sigstore, and application in development, CI/CD, and GitOps workflows.
Zero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
Explore cutting-edge tools for enhancing software supply chain security, focusing on Sigstore, TektonCD, and SPIFFE implementations in zero-trust environments.
Bringing Provenance to Open Source - Lessons from Npm's Sigstore Integration
Explore npm's integration with Sigstore to enhance package provenance, addressing security challenges and implications for the broader open-source ecosystem.
Verifying the Validity of Crowd-Sourced Results in Open Source Security - The Scorecard GitHub Action and Sigstore
Explore how the Scorecard GitHub Action ensures security in open-source projects, using Sigstore for result integrity and remote attestation in crowd-sourced data validation.
Software Supply Chain Security Case Study at Anaconda
Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.
Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling
Explore threat modeling for Kubernetes CI/CD security using SLSA standards. Learn to identify and mitigate vulnerabilities in supply chain processes, with practical insights from Tekton's implementation.
TUF-En Up Your Signatures - Enhancing Software Distribution Security
Explore The Update Framework (TUF) for enhanced software signing and verification. Learn about its security features, integrations, and new developments for secure software distribution at scale.
No Keys? No Problem - Why You Can Trust Sigstore Signatures
Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.
Achieving End-to-End Software Supply Chain Security with in-toto
Explore in-toto's advancements in software supply chain security, including artifact tracking, attestation types, and integrations with CNCF projects for cloud-native identity protection.
Building Sigstore Policies from Scratch
Learn to create and implement Sigstore policies for secure software supply chains, enhancing your project's integrity and trust in the cloud-native ecosystem.
Life of a Sigstore Signature - Understanding Code Signing for Container Images
Explore Sigstore's code signing process for Kubernetes images, including keyless signing, certificate authorities, and transparency logs. Learn to configure admission controllers for cluster security.
Sigstore for Python Packaging - Next Steps for Adoption
Explore Sigstore integration in Python packaging, its benefits for users, and strategies for adoption. Learn about enhancing security in package publishing and consumption workflows.
The Road to SLSA4 - Applying the Sigstore Ecosystem in a Corporate Environment
Explore Sigstore ecosystem implementation for software artifact integrity, covering self-hosting, keyless signatures, OIDC tokens, and verification methodologies in various environments.
Sigstore: Evolution and Future of Software Security Signing
Explore Sigstore's journey in software security signing, its impact on Kubernetes, and future directions. Learn about supply chain security and cutting-edge cryptographic technologies.
Securing Content Repositories with The Update Framework (TUF)
Explore secure content delivery using The Update Framework (TUF). Learn about protecting repositories, managing keys, and recovering from compromises. Discover recent developments and implementation updates.
SLSA FRSCA Recipe for Secure Supply Chain
Explore an end-to-end solution for software supply chain security using OpenSSF-FRSCA, integrating tools like Tekton, Sigstore, and Kyverno to meet SLSA Level 3 requirements.
Verifying Software Signatures with TUF and Sigstore
Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.
So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup
Explore secure setups for private Sigstore instances, covering motivations, threat modeling, and operational requirements for enterprise artifact signing and verification.